CVE-2026-89002: WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk from the resulting script execution?
A user with Contributor-level access or higher can supply a malicious source whose retrieved content is rendered in a campaign item preview. Higher-privileged users are at risk when they review the affected campaign.
What must an attacker be able to do to exploit it?
The attacker needs an account with at least Contributor privileges and must be able to provide a source containing content that is retrieved and displayed by the plugin. Exploitation also requires a higher-privileged user to review the campaign containing the malicious preview content.
Which plugin versions are affected?
WPeMatico RSS Feed Fetcher versions before 2.8.26 are affected. Version 2.8.26 is not identified as affected by the provided information.